Home/Sigma rules
Sigma

Sigma detection rules

4 rules indexed · SIEM-agnostic detection content
Sigma is the open generic signature format for SIEM systems. Each rule below converts to native syntax for Splunk, Elastic, Sentinel, and other SIEMs. Expand any rule to see its raw YAML.
Severity critical high medium low all severities
◈

Detection rules

4 shown of 4
high
DNS Query to External Service Interaction Domains
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
status test author Florian Roth (Nextron Systems), Matt Kelly (list of domains) id aff715fa-4dd5-497a-8db3-910bea555566
view Sigma YAML 
title: DNS Query to External Service Interaction Domains
id: aff715fa-4dd5-497a-8db3-910bea555566
status: test
description: |
    Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
references:
    - https://twitter.com/breakersall/status/1533493587828260866
    - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287
    - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234
author: Florian Roth (Nextron Systems), Matt Kelly (list of domains)
date: 2022-06-07
modified: 2026-01-24
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
logsource:
    category: dns
detection:
    selection:
        query|endswith:
            - '.burpcollaborator.net' # Portswigger Burpsuite Collaborator
            - '.canarytokens.com' # Thinkst Canary Canarytokens
            - '.ceye.io'
            - '.ddns.1443.eu.org' # dig.pm
            - '.ddns.bypass.eu.org' # dig.pm
            - '.ddns.xn--gg8h.eu.org' # dig.pm
            - '.digimg.store' # dnslog.ink
            - '.dns.su18.org' # javaweb.org
            - '.dnshook.site' # webhook.site
            - '.dnslog.cn'
            - '.dnslog.ink' # dnslog.ink
            - '.instances.httpworkbench.com' # httpworkbench.com
            - '.interact.sh' # Project Discovery Interactsh
            - '.log.dnslog.pp.ua' # dnslog.org
            - '.log.dnslog.qzz.io' # dnslog.org
            - '.log.dnslogs.dpdns.org' # dnslog.org
            - '.log.javaweb.org' # javaweb.org
            - '.log.nat.cloudns.ph' # dnslog.org
            - '.oast.fun' # Project Discovery Interactsh
            - '.oast.live' # Project Discovery Interactsh
            - '.oast.me' # Project Discovery Interactsh
            - '.oast.online' # Project Discovery Interactsh
            - '.oast.pro' # Project Discovery Interactsh
            - '.oast.site' # Project Discovery Interactsh
            - '.oastify.com' # Portswigger Burpsuite Collaborator
            - '.p8.lol' # javaweb.org
            - '.requestbin.net'
    filter_main_polling:
        query|contains: 'polling.oastify.com'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate security scanning.
level: high
high
PUA - PingCastle Execution From Potentially Suspicious Parent
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.
status test author Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) id b37998de-a70b-4f33-b219-ec36bf433dc0
view Sigma YAML 
title: PUA - PingCastle Execution From Potentially Suspicious Parent
id: b37998de-a70b-4f33-b219-ec36bf433dc0
related:
    - id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c
      type: derived
status: test
description: |
    Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.
references:
    - https://github.com/vletoux/pingcastle
    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
    - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450
    - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680
    - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699
    - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8
    - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
date: 2024-01-11
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent_ext:
        ParentCommandLine|contains:
            - '.bat'
            - '.chm'
            - '.cmd'
            - '.hta'
            - '.htm'
            - '.html'
            - '.js'
            - '.lnk'
            - '.ps1'
            - '.vbe'
            - '.vbs'
            - '.wsf'
    selection_parent_path_1:
        ParentCommandLine|contains:
            - ':\Perflogs\'
            - ':\Temp\'
            - ':\Users\Public\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp'
            - '\AppData\Roaming\'
            - '\Temporary Internet'
    selection_parent_path_2:
        - ParentCommandLine|contains|all:
              - ':\Users\'
              - '\Favorites\'
        - ParentCommandLine|contains|all:
              - ':\Users\'
              - '\Favourites\'
        - ParentCommandLine|contains|all:
              - ':\Users\'
              - '\Contacts\'
    selection_cli:
        - Image|endswith: '\PingCastle.exe'
        - OriginalFileName: PingCastle.exe
        - Product: 'Ping Castle'
        - CommandLine|contains:
              - '--scanner aclcheck'
              - '--scanner antivirus'
              - '--scanner computerversion'
              - '--scanner foreignusers'
              - '--scanner laps_bitlocker'
              - '--scanner localadmin'
              - '--scanner nullsession'
              - '--scanner nullsession-trust'
              - '--scanner oxidbindings'
              - '--scanner remote'
              - '--scanner share'
              - '--scanner smb'
              - '--scanner smb3querynetwork'
              - '--scanner spooler'
              - '--scanner startup'
              - '--scanner zerologon'
        - CommandLine|contains: '--no-enum-limit'
        - CommandLine|contains|all:
              - '--healthcheck'
              - '--level Full'
        - CommandLine|contains|all:
              - '--healthcheck'
              - '--server '
    condition: 1 of selection_parent_* and selection_parent_ext and selection_cli
falsepositives:
    - Unknown
level: high
medium
PUA - PingCastle Execution
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.
status test author Nasreddine Bencherchali (Nextron Systems), frack113 id b1cb4ab6-ac31-43f4-adf1-d9d08957419c
view Sigma YAML 
title: PUA - PingCastle Execution
id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c
related:
    - id: b37998de-a70b-4f33-b219-ec36bf433dc0
      type: derived
status: test
description: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.
references:
    - https://github.com/vletoux/pingcastle
    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
    - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450
    - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680
    - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699
    - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8
    - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
author: Nasreddine Bencherchali (Nextron Systems), frack113
date: 2024-01-11
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Hashes|contains:
              # PingCastle.exe
              - 'MD5=f741f25ac909ee434e50812d436c73ff'
              - 'MD5=d40acbfc29ee24388262e3d8be16f622'
              - 'MD5=01bb2c16fadb992fa66228cd02d45c60'
              - 'MD5=9e1b18e62e42b5444fc55b51e640355b'
              - 'MD5=b7f8fe33ac471b074ca9e630ba0c7e79'
              - 'MD5=324579d717c9b9b8e71d0269d13f811f'
              - 'MD5=63257a1ddaf83cfa43fe24a3bc06c207'
              - 'MD5=049e85963826b059c9bac273bb9c82ab'
              - 'MD5=ecb98b7b4d4427eb8221381154ff4cb2'
              - 'MD5=faf87749ac790ec3a10dd069d10f9d63'
              - 'MD5=f296dba5d21ad18e6990b1992aea8f83'
              - 'MD5=93ba94355e794b6c6f98204cf39f7a11'
              - 'MD5=a258ef593ac63155523a461ecc73bdba'
              - 'MD5=97000eb5d1653f1140ee3f47186463c4'
              - 'MD5=95eb317fbbe14a82bd9fdf31c48b8d93'
              - 'MD5=32fe9f0d2630ac40ea29023920f20f49'
              - 'MD5=a05930dde939cfd02677fc18bb2b7df5'
              - 'MD5=124283924e86933ff9054a549d3a268b'
              - 'MD5=ceda6909b8573fdeb0351c6920225686'
              - 'MD5=60ce120040f2cd311c810ae6f6bbc182'
              - 'MD5=2f10cdc5b09100a260703a28eadd0ceb'
              - 'MD5=011d967028e797a4c16d547f7ba1463f'
              - 'MD5=2da9152c0970500c697c1c9b4a9e0360'
              - 'MD5=b5ba72034b8f44d431f55275bace9f8b'
              - 'MD5=d6ed9101df0f24e27ff92ddab42dacca'
              - 'MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d'
              - 'MD5=5e083cd0143ae95a6cb79b68c07ca573'
              - 'MD5=28caff93748cb84be70486e79f04c2df'
              - 'MD5=9d4f12c30f9b500f896efd1800e4dd11'
              - 'MD5=4586f7dd14271ad65a5fb696b393f4c0'
              - 'MD5=86ba9dddbdf49215145b5bcd081d4011'
              - 'MD5=9dce0a481343874ef9a36c9a825ef991'
              - 'MD5=85890f62e231ad964b1fda7a674747ec'
              - 'MD5=599be548da6441d7fe3e9a1bb8cb0833'
              - 'MD5=9b0c7fd5763f66e9b8c7b457fce53f96'
              - 'MD5=32d45718164205aec3e98e0223717d1d'
              - 'MD5=6ff5f373ee7f794cd17db50704d00ddb'
              - 'MD5=88efbdf41f0650f8f58a3053b0ca0459'
              - 'MD5=ef915f61f861d1fb7cbde9afd2e7bd93'
              - 'MD5=781fa16511a595757154b4304d2dd350'
              - 'MD5=5018ec39be0e296f4fc8c8575bfa8486'
              - 'MD5=f4a84d6f1caf0875b50135423d04139f'
              - 'SHA1=9c1431801fa6342ed68f047842b9a11778fc669b'
              - 'SHA1=c36c862f40dad78cb065197aad15fef690c262f2'
              - 'SHA1=bc8e23faea8b3c537f268b3e81d05b937012272d'
              - 'SHA1=12e0357658614ff60d480d1a6709be68a2e40c5f'
              - 'SHA1=18b33ab5719966393d424a3edbfa8dec225d98fa'
              - 'SHA1=f14c9633040897d375e3069fddc71e859f283778'
              - 'SHA1=08041b426c9f112ad2061bf3c8c718e34739d4fc'
              - 'SHA1=7be77c885d0c9a4af4cecc64d512987cf93ba937'
              - 'SHA1=72dbb719b05f89d9d2dbdf186714caf7639daa36'
              - 'SHA1=5b1498beb2cfb4d971e377801e7abce62c0e315b'
              - 'SHA1=292629c6ab33bddf123d26328025e2d157d9e8fc'
              - 'SHA1=be59e621e83a2d4c87b0e6c69a2d22f175408b11'
              - 'SHA1=0250ce9a716ab8cca1c70a9de4cbc49a51934995'
              - 'SHA1=607e1fa810c799735221a609af3bfc405728c02d'
              - 'SHA1=ab1c547f6d1c07a9e0a01e46adea3aae1cac12e3'
              - 'SHA1=044cf5698a8e6b0aeba5acb56567f06366a9a70a'
              - 'SHA1=ef2dea8c736d49607832986c6c2d6fdd68ba6491'
              - 'SHA1=efffc2bfb8af2e3242233db9a7109b903fc3f178'
              - 'SHA1=5a05d4320de9afbc84de8469dd02b3a109efb2d4'
              - 'SHA1=a785d88cf8b862a420b9be793ee6a9616aa94c84'
              - 'SHA1=5688d56cbaf0d934c4e37b112ba257e8fb63f4ea'
              - 'SHA1=5cd2ada1c26815fbfd6a0cd746d5d429c0d83a17'
              - 'SHA1=81d67b3d70c4e855cb11a453cc32997517708362'
              - 'SHA1=9cffce9de95e0109f4dfecce0ab2cb0a59cc58ad'
              - 'SHA1=09c6930d057f49c1c1e11cf9241fffc8c12df3a2'
              - 'SHA1=e27bf7db8d96db9d4c8a06ee5e9b8e9fcb86ac92'
              - 'SHA1=9e3c992415e390f9ada4d15c693b687f38a492d1'
              - 'SHA1=3f34a5ee303d37916584c888c4928e1c1164f92a'
              - 'SHA1=ea4c8c56a8f5c90a4c08366933e5fb2de611d0db'
              - 'SHA1=3150f14508ee4cae19cf09083499d1cda8426540'
              - 'SHA1=036ad9876fa552b1298c040e233d620ea44689c6'
              - 'SHA1=3a3c1dcb146bb4616904157344ce1a82cd173bf5'
              - 'SHA1=6230d6fca973fa26188dfbadede57afb4c15f75c'
              - 'SHA1=8f7b2a9b8842f339b1e33602b7f926ab65de1a4d'
              - 'SHA1=a586bb06b59a4736a47abff8423a54fe8e2c05c4'
              - 'SHA1=c82152cddf9e5df49094686531872ecd545976db'
              - 'SHA1=04c39ffc18533100aaa4f9c06baf2c719ac94a61'
              - 'SHA1=e082affa5cdb2d46452c6601a9e85acb8446b836'
              - 'SHA1=a075bfb6cf5c6451ce682197a87277c8bc188719'
              - 'SHA1=34c0c5839af1c92bce7562b91418443a2044c90d'
              - 'SHA1=74e10a9989e0ec8fe075537ac802bd3031ae7e08'
              - 'SHA1=3a515551814775df0ccbe09f219bc972eae45a10'
              - 'SHA256=90fd5b855b5107e7abaaefb6e658f50d5d6e08ac28e35f31d8b03dcabf77872b'
              - 'SHA256=5836c24f233f77342fee825f3cad73caab7ab4fb65ec2aec309fd12bc1317e85'
              - 'SHA256=e850e54b12331249c357a20604281b9abf8a91e6f3d957463fc625e6b126ef03'
              - 'SHA256=9e752f29edcd0db9931c20b173eee8d4d8196f87382c68a6e7eb4c8a44d58795'
              - 'SHA256=7a8c127d6c41f80d178d2315ed2f751ac91b1cd54d008af13680e04f068f426f'
              - 'SHA256=9f65e1c142c4f814e056a197a2241fd09e09acf245c62897109871137321a72a'
              - 'SHA256=c9b52d03c66d54d6391c643b3559184b1425c84a372081ec2bfed07ebf6af275'
              - 'SHA256=1b96f6218498aa6baf6f6c15b8f99e542077e33feb1ab5472bbbf7d4de43eb6b'
              - 'SHA256=768021fc242054decc280675750dec0a9e74e764b8646864c58756fa2386d2a2'
              - 'SHA256=1e1b32bef31be040f0f038fcb5a2d68fb192daaef23c6167f91793d21e06ebae'
              - 'SHA256=606bd75ed9d2d6107ea7ee67063d1761a99f2fb5e932c8344d11395d24587dd6'
              - 'SHA256=b489d3cdd158f040322ae5c8d0139ad28eff743c738a10f2d0255c7e149bd92a'
              - 'SHA256=ca7ecf04a8ad63aff330492c15270d56760cb223a607cdb1431fb00e1b9985d1'
              - 'SHA256=9dc4fca72463078b70f6516559a179c78400b06534e63ee12fb38adbe2632559'
              - 'SHA256=c00d2aee59bac087d769e09b5b7f832176f7714fefdc6af2502e6031e3eb37c2'
              - 'SHA256=a8e96d564687064190eaf865774f773def05fdbf651aa5bbf66216c077b863ef'
              - 'SHA256=84ed328cee2a0505e87662faf6fc57915e3a831c97ee88ad691f5c63522e139d'
              - 'SHA256=c143de99c57965d3a44c1fce6a97c2773b050609c1ea7f45688a4ca2422a5524'
              - 'SHA256=01d1efd5e552c59baa70c0778902233c05fde7de6e5cc156c62607df0804d36b'
              - 'SHA256=9a8dfeb7e3174f3510691e2b32d0f9088e0ed67d9ed1b2afbe450d70dec2016b'
              - 'SHA256=63b92a114075d855f706979d50ed3460fe39f8a2f5498b7657f0d14865117629'
              - 'SHA256=2eb014130ff837b6481c26f0d0152f84de22ca7370b15a4f51921e0054a2a358'
              - 'SHA256=7d5bb4271bf8ca2b63a59e731f3ec831dbda53adb8e28665e956afb4941f32ca'
              - 'SHA256=e57098a75bf32e127c214b61bfba492d6b209e211f065fcc84ff10637a2143ea'
              - 'SHA256=dd14dbcdbcfcf4bc108a926b9667af4944a3b6faf808cf1bb9a3a2554722e172'
              - 'SHA256=dca2b1b824cb28bd15577eace45bde7ff8f8f44705b17085524659de31761de4'
              - 'SHA256=8b95f339a07d59a8c8d8580283dffb9e8dfabdeb9171e42c948ab68c71afe7f2'
              - 'SHA256=5428a840fab6ac4a0ecb2fc20dbc5f928432b00b9297dd1cb6e69336f44eba66'
              - 'SHA256=e2517ae0fccaa4aefe039026a4fc855964f0c2a5f84177140200b0e58ddbfd27'
              - 'SHA256=75d05880de2593480254181215dd9a0075373876f2f4a2a4a9a654b2e0729a41'
              - 'SHA256=56490e14ce3817c3a1ddc0d97b96e90d6351bcd29914e7c9282f6a998cca84b1'
              - 'SHA256=f25d0a5e77e4ed9e7c4204a33cfc8e46281b43adbee550b15701dd00f41bdbe0'
              - 'SHA256=845a5fdcbb08e7efa7e0eabfcd881c9eebc0eec0a3a2f8689194e6b91b6eeaf8'
              - 'SHA256=9a89e6652e563d26a3f328ba23d91f464c9549da734557c5a02559df24b2700d'
              - 'SHA256=5614f2bc9b2ed414aab2c5c7997bdcbe8236e67ced8f91a63d1b6cfbe6e08726'
              - 'SHA256=37bf92dcedb47a90d8d38ebda8d8dd168ef5803dcb01161f8cf6d68b70d49d90'
              - 'SHA256=ec8590f91f5cc21e931c57345425f0625a6e37dfba026b222260450de40459f5'
              - 'SHA256=3994eb72b1c227c593e14b8cad7001de11d1c247d4fbf84d0714bb8a17853140'
              - 'SHA256=d654f870436d63c9d8e4390d9d4d898abdf0456736c7654d71cdf81a299c3f87'
              - 'SHA256=63fbfabd4d8afb497dee47d112eb9d683671b75a8bf6407c4bd5027fd211b892'
              - 'SHA256=47028053f05188e6a366fff19bedbcad2bc4daba8ff9e4df724b77d0181b7054'
              - 'SHA256=7c1b1e8c880a30c43b3a52ee245f963a977e1f40284f4b83f4b9afe3821753dd'
        - Image|endswith: '\PingCastle.exe'
        - OriginalFileName: PingCastle.exe
        - Product: 'Ping Castle'
        - CommandLine|contains:
              - '--scanner aclcheck'
              - '--scanner antivirus'
              - '--scanner computerversion'
              - '--scanner foreignusers'
              - '--scanner laps_bitlocker'
              - '--scanner localadmin'
              - '--scanner nullsession'
              - '--scanner nullsession-trust'
              - '--scanner oxidbindings'
              - '--scanner remote'
              - '--scanner share'
              - '--scanner smb'
              - '--scanner smb3querynetwork'
              - '--scanner spooler'
              - '--scanner startup'
              - '--scanner zerologon'
        - CommandLine|contains: '--no-enum-limit'
        - CommandLine|contains|all:
              - '--healthcheck'
              - '--level Full'
        - CommandLine|contains|all:
              - '--healthcheck'
              - '--server '
    condition: selection
falsepositives:
    - Unknown
# Note: As this is a PUA the level may vary depending on your environment. Reduce or increase the level as you see fit
level: medium
medium
Potential Hello-World Scraper Botnet Activity
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
status experimental author Joseph A. M. id 1712bafe-be05-4a0e-89d4-17a3ed151bf5
view Sigma YAML 
title: Potential Hello-World Scraper Botnet Activity
id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5
status: experimental
description: |
    Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
references:
    - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
    - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
author: Joseph A. M.
date: 2025-08-02
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: proxy
detection:
    selection:
        c-useragent: 'Hello-World/1.0'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
    - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
level: medium
Showing 1-4 of 4
Prev 1 Next
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin